1. Risk Appetite What is risk appetite?
‘’British Standards published BS in October 2008; offers the following definition of risk appetite “the amount and type of risk that an organisation is prepared to seek, accept or tolerate”.
‘’Some organisation prefer the distinction between risk tolerance (maximum risk that can be taken before financial distress) and risk appetite (amount of risk that is actually taken for reward)’’
Risk appetite can be considered as one of the building blocks of an effective risk management initiative. However, there is still considerable debate over the exact meaning of risk appetite:

2. Why is risk appetite important?
An important mechanism for using and embedding Operational Risk frameworks
Principle 3 Management & Control; A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems
SYSC 4.1.1R – A firm must have … effective processes to identify, manage, monitor and report the risks it is or might be exposed to ….
Operational Risk Management  (INSPRU 5)
What are FSA’s expectations?

3. The Walker Review:
Para 6.9 – … the Board has responsibility for the determination of risk tolerance and appetite throughout the cycle……
Recommendation 27:…the risk report should describe ….the associated risk appetite and tolerance and how the actual risk appetite is assessed over time …..

4. Setting a risk appetite
1). Setting a boundary on a probability and impact grid
2). Economic capital measures / balance sheet based expressions
3). Changes in credit ratings (headroom before a potential downgrade)
4). Profit and loss measures (e.g. tolerable level of annual loss)
5). Value based measures (based on probability of ruin or default)
6). Limits / targets or thresholds for key indicators (e.g. +/- 5% variation in profit or 1 - 2½ % variation in revenue)
7). Qualitative statements (e.g. zero tolerance for regulatory breaches or loss of life)
Risk appetite can be expressed and calculated in a number of ways.
Risk appetite statements tend to be created in order to improve Board risk
oversight and risk governance or to communicate expectations for risk-taking
to managers and / or the Board of Directors.

5. Elements of ‘good’ practice in the area of risk appetite are:
Start with a ‘top down’ approach as this aligns better to strategy setting processes in an organisation
Balance the requirements of various stakeholders (not just shareholders)
Understand an organisation’s strategic objectives and associated risks
Align risk appetite with existing management processes (especially personal performance management process)
Differentiate between short-term and longer term risk appetite
Broad communication of risk appetite in an organisation (beyond senior management)
Monitor risk appetite changes over time (retrospectively and prospectively)
Top down approach helps to reinforce the governance and risk culture of an organisation by setting an appropriate ‘tone from the top’.

6. How are risk appetites expressed?
How an organisation expresses its appetite for risk is a key component of the challenge
Some expressions are highly theoretical and quantitative and while they may appear to be robust, they cannot always be understood and therefore used effectively by an organisation’s decision makers.
In contrast more subjective expressions of risk appetite can be both vague and imprecise (such as statements like ‘we have no appetite for making a loss’) and may actually promote inappropriate risk taking behaviour on the part of an organisation’s decision makers.
The solution to this dilemma is to accept that in most cases there is no right way to express an organisation’s appetite for risk and that, depending on the nature, scale and complexity of their activities, different organisations are likely to choose different methods of expression.

7. Benefits of ‘risk appetite?
Improved Board risk oversight and risk governance
Communicate expectations for risk-taking to managers
Communicate risk to the Board of Directors
Achieve greater management consensus around risk
Set limits for risk / reward trade-offs
Increase accountability for management decision-making
A key benefit is that by determining its appetite an organisation should be able to allocate its limited risk management resources more efficiently. In addition, it should help to improve buy-in for risk management activities by highlighting the consequences of not maintaining appropriate levels of risk exposure.

8. Effective Communication of an Organisations Risk Appetitive
There is little point going to the expense of determining an organisation’s appetite for risk if this is not subsequently cascaded to all of its decision makers, so that they can understand the ‘rules’ within which they should be operating.
The importance of effective communication is emphasised by almost all commentators. Effective communication of risk appetite an organisation will help ensure that its management / staff are motivated to make decisions that are in accordance with its appetite for risk.
Moreover if an organisation’s risk appetite is communicated effectively it should promote a risk aware culture where the board / management are not only prepared to talk about their organisation’s risks, but also take prompt action to respond to those risks that are outside of its appetite.

9. Embedding Risk Appetite into Managerial Decision-making
Staff training initiatives – which could be used to promote risk awareness and reinforce an organisation’s qualitative risk appetite statements
Incentive schemes, whereby management might be rewarded for achieving specific economic targets whilst keeping risk indicators within agreed limits
Performance management and objective setting initiatives where staff are given objectives that are directly aligned to current risk appetite priorities
Motivating an organisation’s employees is never easy however there are some practical solutions that can be utilised. Notably an organisation might decide to reflect its appetite for risk within (ref to slide)

10. The Link between Risk Appetite and Risk Monitoring
“Both the risk appetite and risk profile should be continuously monitored by the Board (or equivalent) and formally reviewed at least annually alongside the organisation’s strategy and planning processes. This should consider whether the organisation’s risk appetite aligns with the organisation’s risk profile and that the risk appetite remains appropriate to deliver the organisation’s objectives in light of internal and external drivers and constraints.”
The last significant good practice lesson relates to the importance of risk monitoring within any sound risk appetite framework.
The logic behind this lesson is very simple – in that there is no point an organisation going to the trouble of determining its appetite for risk if it does not then monitor the state of its actual risk profile and the extent to which this deviates from its ideal. This is emphasised within the new British Standard (see slide)
How an organisation goes about determining and monitoring appropriate management information will clearly vary according to the nature, scale and complexity of its activities.
If it is to be effective the approach must be aligned to the ways in which risk appetite is expressed within the organisation.
Refer to University of Nottingham Research paper on the concept of risk appetite